RE: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
"Marko, Peter" <[email protected]> Tue, 28 Jul 2026 18:39:59 +0000
| Newsgroups | org.yoctoproject.lists.meta-virtualization |
|---|---|
| Message-ID | <AM9PR10MB508230EAF658EC9F54AE9E5DFDCB2@AM9PR10MB5082.EURPRD10.PROD.OUTLOOK.COM> |
Gentle ping. -----Original Message----- From: [email protected] <meta-virtualization@lists= .yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org Sent: Sunday, July 19, 2026 10:49 PM To: [email protected] Cc: Marko, Peter (FT D EU SK BFS1) <[email protected]> Subject: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-202= 5-24965 From: Peter Marko <[email protected]> This CVE was fixed in v1.20. This is mentione in NVD report description [1] and github advisory [2]. Explicitly set CVE_STATUS because cve-check still reports it as open. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965 [2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-q= h4j Signed-off-by: Peter Marko <[email protected]> --- recipes-containers/crun/crun_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/= crun_git.bb index d2f7b63b..ea14e8ec 100644 --- a/recipes-containers/crun/crun_git.bb +++ b/recipes-containers/crun/crun_git.bb @@ -67,3 +67,5 @@ RCONFLICTS:${PN} =3D "${@'runc' if d.getVar('CRUN_AS_RUNC= ') else ''}" REQUIRED_DISTRO_FEATURES:class-native ?=3D "" DEPENDS:class-native +=3D "yajl libcap go-md2man m4 libseccomp" BBCLASSEXTEND =3D "native" + +CVE_STATUS[CVE-2025-24965] =3D "fixed-version: Fixed since 1.20"